Multi-model AI orchestration where behaviour is Markdown, not code. One coordinator routes scoped task packets to 71 role-based specialists across 5 model families (Codex / Claude / Gemini / Grok / Kimi) — each working in an isolated git worktree, each reviewed by a rival family before it lands. One tmux session, no server.
This repository also configures its own agents. See what claude-vibe-squad tells them →
Skill Claude CodeCodex
Use when you have a Foundry or Hardhat repository of Solidity or Vyper contracts and want the end-to-end EVM review workflow on native CLIs — a slither static pass, semgrep taint rules, mythril symbolic execution, echidna and medusa invariant fuzzing, halmos formal checks, then a forge build-and-test regression.
Skill Claude CodeCodex
Use when you are sitting on a pile of candidate findings and must cut it down to what is real, reachable, and worth reporting — run each through reproduce-from-clean, reachability, attacker-gain, precondition, and deduplicate-by-root-cause gates, then record which gate every dropped candidate failed.
Skill Claude CodeCodex
Use when a target forks or pins a dependency (a forked cosmos/evm, an old cosmos-sdk/cometbft, a vendored library) — enumerate pinned versions, pull the upstream advisory set, and find known vulnerabilities the target failed to backport. Cheapest high-value pass on any fork.
Skill Claude CodeCodex
Use after automated EVM review has left a small Solidity target needing human-style logic coverage—prepare one source bundle for eight isolated audit stances, then, as the appointed coordinator, deduplicate their returned leads and detect composite chains. Specialists package and consolidate; Chrono alone dispatches…
Skill Claude CodeCodex
Use when an authorized organization needs a passive, public-source inventory of its external footprint—correlate domains, certificates, repositories, registries, exposed cloud assets, and minimal ownership evidence with source, date, and confidence, then separate public-by-design from public-by-accident. Not for…
Skill Claude CodeCodex
Use during an authorized API or gateway assessment when routing or authorization may parse a path differently from downstream execution: test encoded and nested path forms, prove safe-route validation reaches a privileged handler, and chain only if the real target yields controlled impact.
Skill Claude CodeCodex
Use as the first pass on a new Solidity engagement, before any scanner runs, building an audit-readiness x-ray that enumerates permissionless entry points, maps every actor and privileged role, and extracts the protocol's stated invariants so downstream passes have a target list. Reach for it when asked to x-ray…
Skill Claude CodeCodex
Use when you have a candidate finding and must map it to the bounty program's own accepted vulnerability classes, severity language, payout tiers, and submission requirements — confirm the asset is in scope, cite the exact governing policy clause for each claimed impact, and score conservatively where program rules…
Skill Claude CodeCodex
Use when a composable DeFi integration exposes a pricing or share-value view that can be read while the owning protocol is mid-operation behind only a write-side non-reentrant guard, so an attacker re-enters through an ERC-721/1155 receiver or ETH-transfer hook and feeds a second consumer a skewed valuation to…
Skill Claude CodeCodex
Use when you need severity to mean the same thing across reviewers, specialists, and models — place each finding on one shared critical/high/medium/low/note rung by consequence rather than fix effort, keep severity separate from confidence, and declare the deliverable's reporting floor.
Skill Claude CodeCodex
Use during an authorized EVM audit when signature verification may fall back from failed ECDSA recovery to ERC-1271 or may treat zero-code precompile addresses as EOAs—classify every auth entrypoint, then test zero-address fallback and 0x01–0x09 boundaries on a fork with negative controls and invariants. It excludes…
Skill Claude CodeCodex
Use when auditing an Anchor or bare-Rust Solana program end to end; because Solana ships no static analyzers, the coverage strategy is compiler-warning triage, manual source reading, LiteSVM and cargo tests, plus coverage-guided Trident and cargo-fuzz fuzzers before false-positive triage.
Skill Claude CodeCodex
Use for ALL authorized offensive-security / bug-bounty work — the single method to find, chain, prove, dedup, and package the highest-value (High/Critical) findings across every domain (web/SaaS, smart-contract/DeFi, infra/cloud, LLM/AI, mobile, binary/firmware). Enforces two iron laws before any offensive action or…
Skill Claude CodeCodex
Use when actually hunting for exploitable bugs at the bench inside an already-authorized engagement — reading a target, running scanners/fuzzers, sitting on a pile of odd-but-inert observations, tempted to report something "probably exploitable", or about to conclude "nothing found". Applies to every target class…
Skill Claude CodeCodex
Use when the target integrates a Uniswap v4 singleton hook and you must check each hook callback (beforeSwap, afterSwap, beforeAddLiquidity, donate) for the missing-caller-check class — a callback that fails to require msg.sender is the PoolManager or to validate the supplied PoolKey lets an attacker invoke it…
Skill Claude CodeCodex
Use when reviewing Solana program code for the account-model bug classes — unchecked account owner, absent signer, discriminator confusion, caller-controlled CPI seeds, PDA-derivation collision, SPL arithmetic overflow, close-and-reinitialize revival, and duplicate-account aliasing — the pattern census that stands in…
Skill Claude CodeCodex
Use when drafting or revising long-form persuasive technical prose (an essay, post-mortem, launch narrative, or public technical release for X or the web) where the writing must sound human and hold a reader to the end. Do not use for code documentation, changelogs, or short social copy.
At most 3 mods per repository are shown here, and a mod shipped inside a plugin is left to that plugin's page — the rest are on their repository pages: